Quickly using MultiHop Analysis
Your method of using MultiHop Analysis can differ depending on how you obtain, or obtained, the capture files you want to work with. For example, using MultiHop Analysis can be difficult if you have capture buffer files obtained at different times or from probe instances you have no personal access to but someone else does and has sent you captures. Those circumstances are best handled using the process described in Using MultiHop Analysis—and not this section.
This section describes the most efficient, easiest, and quickest way to use MultiHop Analysis but unlike the other section, it requires the following criteria be met for the process to work correctly:
You must have access to all target probe instances from your local Observer (i.e. from the local machine). Ensure that each is in your probe list, is configured, and connected.
You must have sufficient capture buffer sizes across all target probe instances; you do not want one of the probe instance capture buffers to max out too early—leaving you with too little data.
Like other captures, you must have sufficient disk space to save the file(s). This becomes increasingly important when using MultiHop Analysis because you are simultaneously creating and saving more than one capture file, and the disk space required is increased accordingly.
To quickly use MultiHop Analysis, complete the following steps:
1. On the Home tab, in the Capture group, click Configuration > Capture Multiple.
2. Select each probe instance that you want to capture from.
3. Set a pre-filter on any probe instance by selecting a probe instance and clicking Set Filter for Selected Instance.
4. Click Start to begin the packet capture on multiple instances.
The Multiple Instance Packet Capture dialog appears, indicating the capture is actively running. Allow this dialog to remain on your screen.
5. In the Multiple Instance Packet Capture dialog, ensure both “Transfer and Save Packet Captures” and “Start MultiHop Analysis” are enabled.
6. In the Multiple Instance Packet Capture dialog, click Stop. The MultiHop Analysis Settings window appears—automatically loading and listing your new capture files.
7. Configure any additional settings now.
8. Click OK. The MultiHop Analysis tool opens, and your analysis can now begin.
You successfully used MultiHop Analysis quickly and efficiently. This method is the quickest way to perform MultiHop Analysis, although this method does have necessary requirements.